package com.yunhui.admin;

import java.io.IOException;

import java.util.ArrayList;
import java.util.List;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
import com.yunhui.admin.service.AdminCustomerDetailsService;
import com.yunhui.admin.utils.YhPasswordEncoder;
import com.yunhui.entity.YCAdmin;

@SuppressWarnings("unused")
@EnableWebSecurity
public class AdminSecurityConfiguration {

	@Configuration
	@Order(2)
	@EnableWebSecurity
	public static class ClientSecurityConfig extends WebSecurityConfigurerAdapter {
		@Autowired
		private AdminCustomerDetailsService adminCustomerDetailsService;

		@Value("${yunhui.admin.urlContext:/houtai}")
		private String adminUrlContext;
	

		@Value("${yunhui.admin.noLoginUrls:}")
		private String noLoginUrls;


		@Override
		protected void configure(HttpSecurity http) throws Exception {

			List<String> clientNoLoginUrls = new ArrayList<String>();
			if (!noLoginUrls.isEmpty()) {
				for (String s : noLoginUrls.split(",")) {
					clientNoLoginUrls.add(adminUrlContext + s);
				}
			}
			http.headers().frameOptions().disable();
			http.
					//需要验证登录的url
					antMatcher(adminUrlContext + "/**").authorizeRequests()
					//不用登录验证的url
					.antMatchers(clientNoLoginUrls.toArray(new String[0])).permitAll()
					.anyRequest().authenticated().and()
					//开启表单验证
					.formLogin().
					//验证登录的url
					loginProcessingUrl("/houtai/login")
					//登录的页面
					.loginPage("/houtai/login")
					//登录成功后跳转
					.defaultSuccessUrl("/houtai").permitAll().and()
					//退出登录的url
					.logout().logoutUrl("/houtai/loginout")
					//退出登录跳转的页面
					.logoutSuccessUrl("/houtai").permitAll()
					.and().rememberMe().and().csrf().disable();;
			
		}

		@Override
		public void configure(AuthenticationManagerBuilder auth) throws Exception {
			auth.userDetailsService(adminCustomerDetailsService).passwordEncoder(new YhPasswordEncoder());
		}

		/**
		 * 登录成功后的操作
		 * 
		 * @param defaultSuccessUrl
		 * @return
		 *//*
			 * public AdminLoginSuccessHandler getLoginSuccessHandler(String
			 * defaultSuccessUrl) { return new AdminLoginSuccessHandler(defaultSuccessUrl);
			 * } public AdminFailureHandler getLoginFailureHandler() { return new
			 * AdminFailureHandler(); }
			 */
	}

}

//原本配置登录成功和失败的类
/*
 * class AdminLoginSuccessHandler extends
 * SavedRequestAwareAuthenticationSuccessHandler {
 * 
 * 
 * public AdminLoginSuccessHandler(String defaultSuccessUrl) { super();
 * this.setDefaultTargetUrl(defaultSuccessUrl);
 * 
 * }
 * 
 * @Override public void onAuthenticationSuccess(HttpServletRequest request,
 * HttpServletResponse response, Authentication authentication) throws
 * ServletException, IOException { super.onAuthenticationSuccess(request,
 * response, authentication); YCAdmin userDetails = (YCAdmin)
 * authentication.getPrincipal(); logger.info("USER : " +
 * userDetails.getAdminName() + " LOGIN SUCCESS !  ");
 * super.onAuthenticationSuccess(request, response, authentication);
 * 
 * } }
 * 
 * class AdminFailureHandler extends SimpleUrlAuthenticationFailureHandler{
 * 
 * @Override public void onAuthenticationFailure(HttpServletRequest request,
 * HttpServletResponse response, AuthenticationException exception) throws
 * IOException, ServletException { super.onAuthenticationFailure(request,
 * response, exception);
 * 
 * }
 * 
 * }
 */